title: SpendPilot GCP remediation (approve-then-delete)
description: Least-privilege deletes for SpendPilot approve-then-delete — unattached Persistent Disks and unused static external IPs only. Does not allow instance delete.
stage: GA
includedPermissions:
  - compute.disks.get
  - compute.disks.delete
  - compute.addresses.get
  - compute.addresses.delete
  - compute.zoneOperations.get
  - compute.regionOperations.get
  - compute.globalOperations.get